Kenya Data Protection Act compliance.

The partner school is the data controller for learner, guardian, and staff records. Taarifa is the data processor and acts only on the school’s documented instructions, as recorded in our data processing agreement.

Processing is carried out for the performance of the school’s contract with guardians, compliance with legal and curriculum obligations, and the legitimate interests of school administration. Where consent is the basis, for example optional SMS campaigns, the school obtains and records it.

We collect only the fields needed to run assessments, attendance, fees, and communication. Optional fields can be disabled per school, and staff see only the records their role requires.

Encryption in transit and at rest, role-based access control, audit logging of record changes, daily backups, and periodic access reviews. Access to production data is restricted to named personnel.

Where a processor stores data outside Kenya, we rely on contractual safeguards that provide protection equivalent to the Act, and we notify schools of the processors involved.

Confirmed breaches affecting personal data are reported to the affected school without undue delay and, where the Act requires it, to the Office of the Data Protection Commissioner within 72 hours, together with the steps taken to contain the incident.

Requests for access, rectification, erasure, restriction, or objection are routed to the school as controller. Taarifa provides the tools and assistance needed to fulfil them within statutory timelines.

Compliance questions and data subject requests can be sent to info@taarifa.co.ke or raised on 0143 904 538. Guardians may also contact their school’s administration directly.